We launched in January and are using games to make them easier for people. Some of our early testing showed captchas can decrease signups by up to 25% and we're able to recover almost all of that.
We also monitor how you play the game (like mouse movement) so we can ramp up our security without having to make the task more difficult for people. Read more here http://areyouahuman.com/how-playthru-stops-the-bots
I'm skeptical of your efforts to distinguish humans from bots by mouse movements and other inputs. Anything you can infer can be modeled. It's unreasonable to expect a smart captcha cracker to resemble a zero reaction time Counter Strike aimbot.
That being said, we don't just ignore security. There are a lot of captcha alternatives out there that survive on just obscurity, if they were widely adopted, they wouldn't take much to get around (like a slide to unlock captcha). We analyze mouse movement and other behavior, to avoid this.
To test our algorithms, we write our own bots to break our game (as well as working with the AI lab at the university of michigan) and use that data in our machine learning algorithms. We're always tweaking the bot to see how we can beat it and then looking for new features from the data that we can use.
The main point being, that as people do write bots, we can learn from that and incorporate it. We can also adjust the threshold. Some of our customers care much more about usability and just want a minimum level of protection, other's want the threshold a little higher and accept the risk that humans might fail more often.
Considering that your games can be played by a random number generator with something like 10% success rate, you can just skip the captcha completely. Much more user friendly.
The other things you look at to increase security, like detecting patterns and behaviors that indicates bots can be done without a captcha.
Totally agree that we could detect patterns and behaviors without the captcha. Baby steps, though. We'll get there.
Do you consider that blind people are bots?
Screen readers should pick up the alternate text.
<a href="javascript:AYAH_fallback()" style="position:absolute;left:-10000px;top:auto;width:1px;height:1px;overflow:hidden;">Please complete this audio captcha before submitting the form</a>
Also, I know the audio sucks, but it's the most secure out there, otherwise it would just be a giant hole for bots to get through. It's one of the things we want to make better.
In fact, we've experimented with audio games and had some good results.
I agree that the button itself should be easier to discover for blind people, like an image link with a title tag.
We are also planning on a set culturally agnostic (as well as culturally specific) games. If you go to our homepage and refresh through the games you'll see a shape game, that has no language for an example.
We're also getting ready to roll out an update to our API that will allow you to hide/disable the submit button until the game is played. Our testing showed this helped increase submission rates even more.
Finally, we are also trying different styles of games to see what people respond to best.
I'd rather have my signup system use areyouhuman than re-captcha. What makes me uneasy about using it on a massive site is the whole html5 + flash dependency. And the audio captcha alternative you have is terrible. I have better than average hearing and wasn't able to understand anything on my audio sample. That and the re-captcha system helps digitize books while areyouhuman is just playing games. Even though I hate captcha it makes me feel like I'm helping digitize a book when I use recaptcha, so I feel better about it. On the other hand your games are interesting and dare I say it, a little bit addictive, especially with all those congratulatory stars at the end.